From 48812756fc78bcc20bdfc0eabf4bbcb9f9da4f51 Mon Sep 17 00:00:00 2001 From: stumpylog <797416+stumpylog@users.noreply.github.com> Date: Thu, 6 Aug 2026 20:57:23 -0700 Subject: [PATCH] perf: check bulk-edit-objects apply_to_all permissions via DB-side exclude/exists Materialized the full permitted_object_ids() set into a Python set() just to check membership for the request's objs queryset -- the same pattern already fixed at four other sites for Document. This one is used by apply_to_all, where objs can be an unbounded filtered selection (e.g. all tags matching a filter) rather than a small request-supplied ID list, making the wasted materialization worse here than at the sites already fixed. Co-Authored-By: Claude Sonnet 5 --- src/documents/views.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/documents/views.py b/src/documents/views.py index 2d4e7b8bd..3bf0edf7e 100644 --- a/src/documents/views.py +++ b/src/documents/views.py @@ -4789,9 +4789,11 @@ class BulkEditObjectsView(PassUserMixin): if not user.is_superuser: perm = f"documents.{perm_codename}" - permitted_ids = set(permitted_object_ids(user, object_class, perm_codename)) - has_perms = user.has_perm(perm) and all( - obj.pk in permitted_ids for obj in objs + has_perms = ( + user.has_perm(perm) + and not objs.exclude( + pk__in=permitted_object_ids(user, object_class, perm_codename), + ).exists() ) if not has_perms: